PatchTheCVECVE-2020-24217: An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders
CVE-2020-24217 is a critical-severity flaw (CVSS 9.8) affecting iptv\/h.264 video encoder firmware, iptv\/h.265 video encoder firmware, h.264 iptv encoder 1080p\@60hz firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentication. Attackers can send an unauthenticated HTTP request to upload a custom firmware component, possibly in conjunction with command injection, to achieve arbitrary code execution.
Why this priority
- Critical severity
- EPSS top 1%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 40.3% (top 1%) |
| CISA exploited list | No |
| Weakness | CWE-306 |
| Published | 2020-10-06 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: HiSilicon Video Encoders - RCE via unauthenticated command injection
- Exploit-DB: HiSilicon video encoders - RCE via unauthenticated upload of malicious firmware
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-24217?
iptv\/h.264 video encoder firmware: mitigate or apply the listed mitigation; iptv\/h.265 video encoder firmware: mitigate or apply the listed mitigation; h.264 iptv encoder 1080p\@60hz firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-24217 being exploited?
CVE-2020-24217 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-24217 affect?
CVE-2020-24217 affects iptv\/h.264 video encoder firmware, iptv\/h.265 video encoder firmware, h.264 iptv encoder 1080p\@60hz firmware. Severity is critical (CVSS 9.8). An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentication. Attackers can send an unauthenticated HTTP request to upload a custom firmware comp
How urgent is CVE-2020-24217?
Priority 69/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2020-24219 HIGH 7.5 UPGRADE UPGRADE An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97
- CVE-2020-24218 CRITICAL 9.8 UPGRADE UPGRADE An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97
- CVE-2020-24216 HIGH 7.5 MITIGATE MITIGATE An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders
- CVE-2020-24215 CRITICAL 9.8 MITIGATE MITIGATE An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders
- CVE-2020-24214 CRITICAL 9.8 MITIGATE MITIGATE An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders